Today, we are releasing Magento Enterprise Edition and Community Edition 2.0.6, which contain important functional improvements. You can now use Redis for session storage and a file permission issue has been fixed by providing a more flexible way to set file ownership. Full details on the functional enhancements are included in the release notes for Enterprise Edition and Community Edition.
Additionally, the release has several security improvements, including:
- Stopping unauthenticated users from using REST or SOAP API calls to remotely execute malicious code on the server.
- Preventing a site from being remotely triggered to reinstall itself so that the attacker can potentially take control of it.
- No longer allowing authenticated customers to change other customers’ account information using SOAP or REST API calls.
- Fully resolving a previous vulnerability with cross-site scripting in the Authorize.net payment module.
More information regarding the security updates is available on the Magento Security Center.
ACCESSING THE RELEASE
You are advised to deploy this new release right away. It can be accessed from the following locations:
If you have not previously upgraded to Magento Enterprise Edition 2.0.2 or later releases, you should review the upgrade information posted on our Security Center as there are some additional steps you may need to take. This update should be installed and tested in a development environment before being put into production. Also, please use this occasion to do a security assessment in accordance with our Security Best Practices.
Thank you for your prompt attention to these issues.
